mac addressrouter
I'm trying to figure out the MAC address of my router.
This picture is of using the command ipconfig:
This picture is of using the arp -a command:
I see it says my IPv4 address is 192.168.1.114, so I go down to it in the arp -a command. However, there are many different MAC addresses for it. It also says the default gateway is 192.168.1.1, so my question is: Which one is my router MAC address? Help would be appreciated. Thanks!
GLBP doesn't use gratuituous ARP. When someone asks which MAC does the virtual IP have, the AVG will reply saying "This IP is at this MAC", using the field "Sender MAC Address", which is invisible to the switch's CAM table. The source address is still the AVG MAC.
EDIT: I said it wrong. The IP address requested is actually the Sender, the Target address is the address of the host that sent the arp request in the first place. I'll just upload here an example of ARP Request and Reply and when I get home I'll simulate on GNS so you can see how it really works and not just an example capture.
Cadant device asks which is the MAC for x.x.128.77 and if anyone has the answer, please direct it to x.x.128.164.
Oracle device then replies with a broadcast saying that x.x.128.77 is himself, at the MAC 00:14:4f:fb:c3:16, at the sender MAC address. The target is x.x.128.164, who was the one requesting.
If this was the case of a GLBP host, it would state the virtual MAC in the sender MAC address field. It's called Proxy ARP. Just hold tight, I'll upload the actual GLBP capture in about 10 hours.
GLBP Capture:
R2 is the AVG, R1 the AVF:
HOST 192.168.0.200 asked for the MAC of 192.168.0.1, the GLBP VIP. He received an answer from C001.3270.0000, which is the real MAC of the interface fa0/0 from R2, stating that 192.168.0.1 was located at 0007.B400.0101, one of the virtual MAC .
Later on, HOST 192.168.0.201 asked for the MAC of 192.168.0.1 and received an answer from the same C001.3270.0000 saying that this IP was with the MAC 0007.B400.0102, the other virtual MAC. Wireshark even throws a yellow line saying that "Hey, lookout, this IP is in use by another host".
When issuing "show glbp" from both routers, the AVG output have a little more detailing, including how many times it answered and ARP request with this or that virtual MAC address. You can see the MAC and IP addresses of the interfaces in "Group Members", present in both outputs.
ARP spoofing is just the thing that is doing the multiple MAC's for one IP. :) So if you want to avoid duplicate adresses... stop ARP spoofing (poisoning) your network.
If you want to understand this, read the following page:
Best Answer
According to your screenshot, the ARP Cache entry for 192.168.1.1 is
c8d7.1914.f1d1, which is likely the MAC address of the router interface to which you are connected.According to your output of
ipconfig/all, the MAC Address of your Network Interface is844b.f522.6f98.